CVE-2026-101301: WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPCode WordPress pluginto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Who is affected by this issue?
Sites using the WPCode WordPress plugin in versions 2.0.0 through 2.3.9 are affected. The issue concerns automatically inserted snippets and can be triggered by unauthenticated visitors.
What does an attacker need to exploit it?
No authentication, user interaction, or special privileges are required. An attacker only needs to send a request that causes WPCode to enter snippet safe mode without the request genuinely being for the login screen.
What is the impact of successful exploitation?
The attacker can disable all automatically inserted snippets for their own requests. The provided information does not indicate that snippets are disabled for other visitors or permanently changed.
What should administrators do?
Update WPCode to version 2.4.0 or later. The issue is fixed in 2.4.0.